Repository navigation
fix(deps): remediate 77 CVEs across 10 packages, includes critical eMudhra certifi fix - #533
Open
pkgwarden-bot wants to merge 1 commit into
Open
pkgwarden-bot wants to merge 1 commit into
pkgwarden-bot wants to merge 1 commit into
Conversation
…certifi fix Opened by pkgwarden whole-set CVE remediation. Signed-off-by: JP Cassil <jp.cassil@pkgwarden.com>
pkgwarden-bot
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This project pins certifi below 2026.10.19, the release that removes the emSign root CA after eMudhra's private-key compromise (GHSA-6q48-6c7w-9gw2, critical). Chrome drops the root on 2026-10-27, so TLS verification against affected sites starts failing this week. Rather than bump one package, this pull request raises the whole dependency set to the lowest versions that clear every known advisory in one pass, with no downgrades, so you get a single reviewable change instead of a drip of bot PRs. Every bump is a package-manager resolve against public PyPI; nothing here is hand-edited.
Why you are getting this pull request
This pull request comes from pkgwarden, a dependency-security tool. It was reviewed by @johncassil before it was sent. We ran whole-set CVE remediation against this repository's lockfile: instead of one pull request per advisory, it works out the smallest set of version floors that clears every known CVE the lockfile can clear, resolves them with your own package manager, and lists what could not be fixed and why.
Nothing here subscribes your repository to anything. We do not watch it, and no further pull requests will come unless a maintainer asks for them. If this change is wrong for your project, please close it; a one-line reason helps us improve. If it breaks your tests, or you would like it narrowed, please comment and we will follow up. We are also looking for a few open-source projects to work with as design partners, at no cost; comment here or write to hello@pkgwarden.com if that interests you. To opt out of any future contact, reply here or write to the same address.
The full decision record for this change is at https://gate.pkgwarden.com/remediation/runs/Ekw_6RHgBz8ZCzbsW9EZV6T-j59ehvgCkqNKjUcBFX8.
pkgwarden ran whole-set CVE remediation against https://github.com/evermind-ai/everos.
You had 77 CVEs across 10 packages (1 direct, 9 transitive). This PR fixes 77 CVEs across 10 packages. Nothing remains.
Packages this PR raises
anyio4.14.2CVE-2026-63349,CVE-2026-63374,CVE-2026-64847cairosvg2.9.1CVE-2026-107378certifi2026.10.19GHSA-6q48-6c7w-9gw2idna3.15CVE-2026-45409mako1.4.2CVE-2026-102991opentelemetry-api1.45.1CVE-2026-114603pillow13.0.0CVE-2026-112390,CVE-2026-112391,CVE-2026-112392,CVE-2026-112393,CVE-2026-112394,CVE-2026-112395,CVE-2026-112396,CVE-2026-112397,CVE-2026-112399,CVE-2026-112400and 42 more (see trace)soupsieve2.9CVE-2026-85999,CVE-2026-86000urllib32.8.0CVE-2026-97687,CVE-2026-97688,CVE-2026-97689virtualenv21.14.9CVE-2026-102925,CVE-2026-102930,CVE-2026-102937,CVE-2026-102938,CVE-2026-113716,CVE-2026-113721,CVE-2026-113722,CVE-2026-113724,CVE-2026-113725,CVE-2026-113726and 2 more (see trace)What this PR does not fix
Nothing. Every vulnerability we found in this unit is addressed above.
Machine-readable decision trace
Every decision above is recorded, in order, at https://core.pkgwarden.com/api/v1/remediation/runs/Ekw_6RHgBz8ZCzbsW9EZV6T-j59ehvgCkqNKjUcBFX8/trace.
The same run as a page you can read: https://gate.pkgwarden.com/remediation/runs/Ekw_6RHgBz8ZCzbsW9EZV6T-j59ehvgCkqNKjUcBFX8.